Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__).

Is this a possible risk for the site? If a non controlled error message show the internal path of the Joomla directory, because of, for example a failed include, can it be used to perform some kind of attack to the site? If yes, is it convenient to use this function?

share|improve this question
Security aside, it's great for code portability. – Adrian Schneider Oct 20 '12 at 2:40
up vote 1 down vote accepted

You shouldn't show the PHP error messages to users in the first place. So no, it's not a risk.

Also, if the only safety measure on the server is to hide the path where the source code is located, then... well... you should be more concerned by other risks then showing the path to the users.

Finally, by using relative paths, you're potentially introducing more security holes. See for example Preventing Directory Traversal in PHP but allowing paths.

share|improve this answer
Yes it's true, there are a lot of other security measures to take against web attacks, but I just was wondering if this one could be one of these, things are clearer now. Thanks. – webose Oct 20 '12 at 20:55

__FILE__ is a native global variable that holds the path of the script that's being executed, and dirname(__FILE__) will return the directory part of that path. There's absolutely no way this will fail, if the path in __FILE__ doesn't exist or is invalid, you couldn't have called the script in the first place anyway.

Generally speaking you shouldn't let any PHP errors (including warnings and notices) reach the user, read up on error_reporting and display_errors.

share|improve this answer
Unless they were removed during script execution, but that's a side-case that means you're doing something wrong... – Izkata Oct 20 '12 at 15:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.